Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 14 of 21
Jun 17, 2026Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.CVE-2026-22327 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.CVE-2025-69179 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69129 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.CVE-2025-69122 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.CVE-2025-69108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.CVE-2025-60218 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026ThemeREX Group ThemeREX Addons trx_addons: Deserialization of Untrusted DataCVE-2025-60205 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
- Product
- ThemeREX Group ThemeREX Addons trx_addons
- Affected
- up to 2.36.1.1
- What to do
- Affects up to 2.36.1.1. Update ThemeREX Group ThemeREX Addons trx_addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.CVE-2024-52488 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 16, 2026themagnifico52 Kids Online Store: Unrestricted Upload of File with Dangerous TypeCVE-2026-40750 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.
- Product
- themagnifico52 Kids Online Store
- Affected
- up to 0.8.9
- What to do
- Affects up to 0.8.9. Update themagnifico52 Kids Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-52715 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 16, 2026Filipe Nasc RD Station: Improper Control of Generation of Code ('Code Injection')CVE-2026-49774 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.
- Product
- Filipe Nasc RD Station
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update Filipe Nasc RD Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49772 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
- Product
- Liquid Web / StellarWP The Events Calendar
- Affected
- up to 6.16.2
- What to do
- Affects up to 6.16.2. Update Liquid Web / StellarWP The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.CVE-2026-39574 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.CVE-2026-9691 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.CVE-2026-52703 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.CVE-2026-52693 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.CVE-2026-49781 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.CVE-2026-49776 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.CVE-2026-49770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.CVE-2026-49769 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.CVE-2026-49768 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.CVE-2026-49766 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.CVE-2026-49765 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.CVE-2026-49764 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.CVE-2026-49763 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.CVE-2026-49109 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.CVE-2026-49106 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.CVE-2026-49104 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49085 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.CVE-2026-49067 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.CVE-2026-48886 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.CVE-2026-48881 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.CVE-2026-48836 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45439 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.CVE-2026-42665 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.CVE-2026-42639 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.CVE-2026-42386 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.CVE-2026-42381 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.CVE-2026-40798 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.CVE-2026-40772 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.CVE-2026-40771 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.CVE-2026-39591 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.CVE-2026-39583 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.CVE-2026-39530 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.CVE-2026-39519 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.CVE-2026-39493 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.